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1 The above-entitled matter came on for hearing on Thursday, January 

2 22, 2009, at The U.S. Patent and Trademark Office, 600 Dulany Street, 

3 Alexandria, Virginia, before Victor Lindsay, Notary Public. 

4 MS. BEAN: Good morning. We have calendar no. 49, Appeal 

5 No. 2008-3 109. Mr. Syed J. Ali and Mr. Rick Toering, counsel for 

6 appellant. 

7 JUDGE MARTIN: Thank you. Good morning. 

8 MR. ALI: Good morning. 

9 JUDGE MARTIN: You can proceed whenever you're ready. 

10 MR. ALI: Okay. So basically there's, there's two groupings of claims 



1 1 here that we'd like to discuss. The first one, you know, starting with 

12 independent claim 1 and the second one starting with independent claim 23. 

1 3 Start with the first one, and then we'll move on to the second one and that - 

14 but the main thing we want to emphasize with, with independent claim 1 is 

15 really the, the way in which we're reciting the terms events, alarms, and 

16 alarm - and correlated alarms in distinct context which mean just different 

17 things. 

1 8 And basically, the Examiner kind of on the one hand is conflating the 

19 terms events and alarms and, on the other hand, is inconsistent in the way 

20 that he is applying the references against those, those specific terms. So the 

21 main thing is that in, in the system which really into service level 

22 management, once you define a specific service that you are providing over 

23 a network and mapping those to, you know, a relevant service, perhaps it's 

24 ensuring it adequate bandwidth allocation or something like that, the monitor 

25 to that network and all the devices in the network might fire off events and 
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1 these agents, these monitoring agents will then sift through those events and 

2 map those to an alarm and — 



3 JUDGE HOMERE: What is an alarm, counsel? 

4 MR. ALL I'm sorry? 

5 JUDGE HOMERE: What is an alarm? 

6 MR. ALI: Alarm is basically — it's a function of an event. So the 



7 alarms -- the agents will take in a series of events, could be hundreds, 

8 thousands of events, and based on the relationships between those events, 

9 map those into an alarm. So basically an alarm is, is a certain type of 

10 message. It conveys a certain type of information. For example, like in the, 

11 in the last clause of independent claim 1 here — 



12 JUDGE HOMERE: Okay, okay, so okay, let's get this straight. An 

13 alarm is a message. 

14 MR. ALI: It could be a message. That's, that's one potential thing. 

15 But basically what it is is it's a way of relating the, the events that are 

16 coming out of the network. It's a way of relating those into a different data 

17 abstraction that means a different thing. 

1 8 Does that answer your question? 

19 JUDGE BARRY: That's our understanding, that alarm is a message. 

20 MR. ALI: Right. 

21 JUDGE HOMERE: Okay. 

22 JUDGE BARRY: A notification. 

23 MR. TOERING: In -- but in, in the context of network 

24 communications, events have meaning, especially when we're talking about 

25 monitoring network components. Events have meaning, and alarms have a 
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1 meaning, and those are different things within that particular context. In this 

2 art, events have meanings, and certain events generate alarms. Alarms are 

3 things that need to be acted on, that need to be done, are different than just 

4 ordinary traffic. So in, you know, you know, we would refer to the spec to 

5 come up with a specific meaning of an alarm, but yes, an alarm at some level 

6 is an indication, conveyor of information to something that's looking for 

7 alarms not just looking for generic messages, not just looking for generic 

8 events. It is a specific type of event or a specific type of message generated 

9 from in the context of an event that may be problematic, require action - 



10 JUDGE BARRY: A notification of an event. 

1 1 MR. TOERING: -- notification, something like -- 

12 MR. ALL Or sequence of events or - 

13 MR. TOERING: - to, to simply say that - 

14 JUDGE BARRY: One or more events. 

15 MR. TOERING: — to simply say that an alarm is a message is not 



16 appropriate, okay. That interpretation is, is too broad, not reasonable in 

17 terms of scope of examination for purposes of saying well, an alarm is 

18 merely a message. An event is merely a message. These things are the same 

19 thing. A network systems guy, when you say an event, you say an alarm, he 

20 recognizes those things as being distinct. 

21 MR. ALL Right, just to amplify that point one bit, you know, I think 

22 that maybe you're referring to what the Examiner put in the answer where he 

23 said that there's nothing in the claims that would suggest an alarm is 

24 anything but a message, and you know, that -- what that fails to -- what that 

25 seems to suggest - 
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1 JUDGE BARRY: Counsel, where in the answer? What page? 

2 MR. ALL I think it's on — let me find the page it's on. 

3 JUDGE BARRY: I'd like to bookmark that in the electronic file. 

4 MR. ALI: Sure. It's on page — I'm sorry, page 14. Examiner says 



5 that there's no teachings in the claim that would suggest an alarm is anything 

6 but a message as to what happened in a network, either bad or good. So 

7 what seems to be happening there is the Examiner is conflating what an 

8 event and alarm is, because he's referring to Maccabee which is entirely 

9 relating to event processing and correlating of events. So basically I think 

10 what he's trying to get at is there's no difference between an event and alarm. 

1 1 Both are a message and that there's no distinction there so -- 

12 JUDGE MARTIN: Now you argued in your brief, I believe, that an 

13 alarm is - has something to do with the operational characteristics. 

14 MR. ALI: Right. Well, the events relate to operational characteristics 

15 of the network, and then the agents take those events and map those into an 

16 alarm. So what comes out of the operational characteristics of network is 

17 then mapped -- the events are then mapped into something else. Events then 

18 become alarms. So there might be some filtering there, some different 

19 processing going on there, but what comes out of all this event processing is 

20 alarms which are different from the events. Then those alarms are 

21 forwarded to the alarm correlation agent which performs correlation on 

22 those alarms to produce correlated alarms. So essentially what you have is 

23 two levels of correlation, from events mapped to alarms and then alarms to 

24 correlated alarms, and none of the references perform such correlation. 
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1 The Examiner, you know, primarily relies upon Maccabee which 

2 relates entirely to one, one level of event processing, sensors, end processor 

3 generated events that are forwarded to the agents. The agents act as kind of 

4 aggregation points for these events and forward them to the transaction 

5 generator. Those look at the different events and then produce, you know, 

6 correlate the listed transactions. 



7 JUDGE MARTIN: Let, let me stop you there for a second and ask 

8 you, it seems to me that the Examiner is reading the claim term "events" 

9 onto the things that are being monitored by the sensors in Maccabee? 

10 MR. ALL It appears so, yes. 

1 1 JUDGE MARTIN: And then reading "alarms" on what Maccabee 

12 calls "events"? 

13 MR. ALL Right, he's - 

14 JUDGE MARTIN: And reading "correlated alarms" on what 

15 Maccabee calls "transactions"? But I don't get that from your brief — 

16 MR. ALL Yeah, right, exactly, exactly. So there's, so there's — so 

17 what -- exactly right. 

18 JUDGE MARTIN: Okay. 

19 MR. ALL So what's missing there is the mapping for events to alarms 

20 so the Examiner is - 

21 JUDGE MARTIN: Why isn't the sensor - 

22 MR. ALL - pointing to two different things or I'm — pointing to the 

23 same thing and calling it events and then calling it alarms. 

24 JUDGE MARTIN: Now why isn't the, the sensor mapping what it's 

25 monitoring to - which is an event I guess - why isn't it mapping it into an 
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1 alarm? What is it about the sensor that's not doing this mapping? Let me 

2 put it that way. 

3 MR. ALL Well, the — okay, for example, just to kind of establish this 

4 context, when a network device is operating and a certain amount, you 

5 know, it's processing data in a certain way, events will only fire when certain 

6 criteria are met. So for example, when some threshold is reached like 

7 packets are being dropped or, or bandwidth is below a certain level or 

8 something like that. So there are certain rules that are established there to 

9 determine when an event should or should not be generated. Okay, so that's 

10 even at a lower level. 

11 JUDGE MARTIN: Wait. I'm sorry, I'm not -- 1, 1 don't want to lose 

12 track of where you're going. I have to back up a second. Are you saying - 

13 let me ask you this. Is, is the Examiner incorrect to read the claim term 

14 "event" on the things that are being monitored by the sensors in Macabee? 

15 MR. TOERING: Yes. 

16 JUDGE MARTIN: And why is that? Does event have a special 

17 meaning that, that is, more than just some operational characteristic? 

18 MR. TOERING: The -- there is stuff, communications, data, 

19 messages, whatever you want to call it, occurring throughout the network. 

20 Thousands and thousands of messages are being sent, acknowledges 

21 requests, hey, I'm going to do something. Be ready for it. Here it comes. 

22 All this type of information goes back and forth, okay. When you put an 

23 agent on the network, that agent's job is to monitor that traffic, okay. That 

24 agent's job is to monitor those things. The agent monitors the events. In the 

25 context of this, that event is those message trafficking back and forth. Those 
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1 events are -- in the context of Macabee, those events are things that 

2 correspond to a transaction which is let's say I want to update a database, I 

3 want to update this database. I'm going to supply a set of information over a 

4 network to make sure the database gets updated. The first thing I'm going to 

5 say, I'm going to issue a request to update this database. That becomes an 

6 event. I'm going to — that's going to generate - open a file, so that's going to 

7 generate an event. The -- when the file is open, it says file's opened. That's 

8 going to generate an event. All these things, all this traffic, all these stuff 

9 that's going on, so that everybody understands, the various parties to that 

10 communication understand what's going on, those are events. 

1 1 JUDGE HOMERE: Why -- but I'm sorry, why wouldn't that -- the 

12 notification of an event be an alarm? The sequence — and you have just 

1 3 updated the database, and then we notify the database administrator a 

14 particular database has just been updated. Why would that not be an alarm? 

15 MR. TOERING: Well, in part, because that transaction information is 

16 telling people what is going on and it's, it's assumed to be a, you know, it's 

17 assumed to be part of the required mechanism to accomplish the overall 

18 transaction. So all of those, all of those events are aggregated together to 

19 form that entire transaction of updating the database. 

20 Alarms — I mean, alarm has a very specific meaning, right, in the, in 

21 the context. It means something is wrong. Something wasn't normal. The, 

22 the delay - the response was too long. We dropped packets. Something 

23 happened here, and the alarm is then supposed to be sent in the network that 

24 says something is wrong. I didn't get what I expected to get. I didn't have 

25 this. I didn't have that, and the monitoring of what we're doing is we're 



8 



Appeal 2008-3109 
Application 09/577,224 



1 monitoring this traffic, and we're saying are any of these events supposed to 

2 map into an alarm? If something happens here in this traffic, this event 

3 information, then we need to generate an alarm — 

4 JUDGE HOMERE: So, so are you saying that only a negative -- only 

5 the, the notification of a negative event would constitute an alarm in this 

6 case? 

7 MR. TOERING: I, I hesitate to say that only a negative event would 

8 generate an alarm and that -- 

9 JUDGE HOMERE: Well, well, technically that's what you're saying, 

10 because if you have a positive event such as updating a database, and you 

1 1 notify an administrator saying that's not an event, whereas if a database 

12 failed to update, and then notify the administrator, that is an alarm - 

13 MR. TOERING: I - that - I gave that as - 

14 JUDGE HOMERE: - on the - 

15 MR. TOERING: — as an example of what could generate an alarm. 

16 There may be a variety of different things that translate from events that are 

17 occurring into alarms that need to be, you know, require certain notification. 

1 8 JUDGE HOMERE: No, but you're not answering my question, 

19 counselor. 

20 MR. TOERING: Well, because the question is not a question that I 

21 can, I can say that an alarm is a negative event. That may not be the case. 

22 JUDGE HOMERE: No, but I gave you a specific example, and then I 

23 said well — updating a database. You notify the administrator that the data 

24 has been updated. You said well, that would not necessarily be an alarm 

25 whereas if you - if that database failed to update, and then you notified the 
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1 administrator, then that would comport, that would be in line with your 

2 definition of what an alarm is. 

3 MR. TOERING: It's hard for me to say that every single event could 

4 be cast as a negative event. I, I just -- 1 would just be reluctant -- 

5 JUDGE HOMERE: No, I'm talking about the specific example I, that 

6 I gave you. You're dancing around the question again. If you're updating a 

7 database you, you inform -- you notify the administrator. Would that be an 

8 alarm in this particular — in this specific example? 

9 MR. TOERING: In this specific example, if, if something failed, 

10 something was out of limits, an alarm would be generated. 

1 1 JUDGE HOMERE: Okay, whereas if, if nothing failed, but you 

12 simply, you simply notified the, the administrator that an update had just 

1 3 taken place, that would not be an alarm? 

14 MR. TOERING: Probably not, no, that would not be alarm, that 

15 would not be an alarm in that specific example. 

16 JUDGE HOMERE: Okay. All right, proceed. 

17 MR. ALL Just to like emphasize that, like you know, again this - 



18 what it specifically relates to is, is service levels here. So what these events 

19 are are associated with operational characteristics of network service 

20 associated with, with a service-level management domain. So essentially 

21 they're mapped to this abstraction over the network of a specific type of 

22 service you're trying, trying to provide in that network, and then again, again 

23 referring to the claim language here, provides a little more context here. It 

24 says that, you know, the alarms and correlated alarms are indicative of 

25 degradation in service level or potential degradation in service level so — 
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1 JUDGE MARTIN: You didn't rely on that language in your brief. 

2 You didn't, you didn't — I mean, you, you read it on the spec in the — under 

3 the summary of the invention, but in your argument you didn't rely on that 

4 as, as in -- 

5 MR. ALL You know, we try to be clear and concise in - 

6 JUDGE MARTIN: - as limiting - 

7 MR. ALL — our arguments, and I think that, you know, the context 



8 we're really trying to get at here is, is the different mappings that are going 

9 on, the different levels of correlation. The, the final whereby clause just 

10 provides a little bit of context in terms of what an alarm might mean. You 

1 1 know, we didn't want to get too bogged down into, into what the nature of an 

12 alarm was. We really want to try to emphasize these two different levels of 

1 3 mapping and then correlation, so that, that might be why we, we didn't really 

14 discuss that at length in the brief. 



15 JUDGE MARTIN: I guess I'm still not sure why what's being 

16 monitored by the sensors in Macabee are not events in a broad sense. 

17 There's no definition of event, is there, in the, in the — certainly not in the 

18 claim but even in the spec -- that would preclude us from reading -- 

19 MR. ALL Well, the sensors aren't monitoring events. The sensors are 

20 forwarding events. I mean, there's — 

21 JUDGE MARTIN: Well, they're sensing -- that's monitoring -- aren't 

22 they? 

23 JUDGE BARRY: Take a look at column 7 on this very note, column 

24 7 of Maccabee's. The paragraph around 37, line 37, figure IB depicts, talks 

25 about the sensors monitored to are changes in state. 
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1 MR. ALL Right. 

2 JUDGE BARRY: So why isn't a change in state an event albeit by a 

3 different name? 

4 MR. ALL Well, it's the same thing as the event. Certain changes in 

5 state might give rise to events -- 

6 JUDGE BARRY: Well, well, read on, though. It says, let's see, lines 

7 54 and 55, "When appropriate, the sensor generates an event that describes 

8 the change in state." 

9 MR. ALL Right. 

10 JUDGE BARRY: Next line, "Where it occurred and any extra data 

1 1 necessary." So clearly an event is a label or notification of a change in state. 

12 So it's not the same thing in Macabee. 

13 Go ahead, John, I interrupted. 

14 MR. ALL I'm sorry - 

15 JUDGE MARTIN: I'm not sure - 

16 MR. TOERING: So it's, so it's, it's the Examiner's position now, at 



17 least being articulated by -- through the Board, it's the Examiner's position 

18 that a change of state is our equivalent to our language "an event," and the 

19 change of state, what the, what the monitor, what the sensor does in response 

20 to the change of state is to generate a message which is corresponding to our 

21 "alarm," and it is the correlation of events in the context of a transaction 

22 which is the same thing as our "correlation of alarm"? 

23 JUDGE MARTIN: Right. 

24 MR. TOERING: So -- but unfortunately, that's -- so it's a tortured 

25 interpretation of the reference, because we too have the events. Our events 
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1 are based on changes of a state of a network component upstream from 

2 where that event was generated, right? 

3 JUDGE MARTIN: I'm sorry, Why doesn't that also apply to 

4 Maccabee, what you just said? 

5 MR. TOERING: Because what, what you're saying is that there's a 



6 stream of things. There's a change of state, there's an event that's generated, 

7 and then there's some transaction that's happening. What we're doing is 

8 we've shifted it, and we're picking it up at the event location. We haven't 

9 articulated the fact that there's a change of state prior to the occurrence of an 
10 event, and so what's happened is, is that the - 



1 1 JUDGE MARTIN: Oh, I'm sorry. Let me stop you for a second and 

12 get some clarification. By changing of state, you're talking about overall 

13 networks, right? 

14 MR. TOERING: No, I'm, I'm talking about - 

15 JUDGE MARTIN: You're not talking about the particular thing being 

16 monitored? 

17 MR. TOERING: In, in the context of our claim, in the context of our 



18 claim, the event that we're saying our agent is monitoring is a result of some 

19 change of state prior, okay. Some, something happened at a network level 

20 that caused a -- that was a change of state that generated this event. So 

21 what - in, you know, in what - as one of ordinary skill in the art would 

22 understand, this event is this event. This event is not a change of state. The 

23 event in both cases are results of changes of state occurring elsewhere in the 

24 domain. We didn't claim a change of state. We didn't use that language, 

25 change of state, in our claim, because we believe that an event is well 
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1 understood to be this type of message transactions that are occurring within 

2 it and we — if we monitor those events, we don't also have to monitor change 

3 of states. If something else is monitoring changes of states to generate 

4 events, that's something different. Events - we're monitoring events that are 

5 occurring in the network. Events have specific meanings in the context of 

6 network - in service level parameters, all the rest of that stuff, and alarms 

7 have specific meanings. 



8 JUDGE MARTIN: Yeah, see, I don't see where the specific meaning 

9 of "event" is - has been established on the record as being narrower than 

10 the - what the Examiner — how the Examiner is construing the term. 

1 1 MR. TOERING: I think the "events" of Maccabee correspond to the 

12 "events" of our claim language, and what's happened is that through, 



13 through a tortured interpretation, the event is, is really not an event. The 

14 event is, is being pointed at as some sort of change in state, and the 

15 Examiner said well, that's really the event, and the event is generating an 

16 alarm despite Macabee saying that the event - the change of state is 

17 generating an event which people understand an event to be an event. 



18 JUDGE BARRY: Okay, so you want us to use effectively Maccabee 

19 as that evidence? When Maccabee talks about an event, it means an event — 

20 MR. ALL Right, so the sensors and processors -- 

21 JUDGE BARRY: -- in the same sense that you do? 

22 MR. ALL — generate events that are received at agents in Maccabee. 

23 Those events I think it would be fair to say are similar to the events that 

24 we're monitoring here. What's lacking is the mapping of that to alarms and 

25 then the further correlation of that. The events are just taken, aggregated at 
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1 the agents, and the agents don't do any processing of that. They just forward 

2 them on to the transaction generator. There's no mapping of those events to 

3 alarms. Let — 

4 MR. TOERING: And the entire purpose here of, of the transaction 

5 issue is to take these events, aggregate them and say which of these are 

6 related to one another for purposes of this transaction, for purposes of 

7 accomplishing this network task. That's what that means. These events get 

8 aggregated together, their relationships are, are generated to perform a 

9 transaction. A transaction in the network has — again has a specific 

10 meaning. Okay, we are looking at alarms and correlating alarms to 

1 1 understand whether those correlated alarms have an impact on an overall 

12 service, not on a specific transaction, right, and so if, if there's a twist in 

1 3 interpretation, we end up in this sort of weird thing where we're not talking 

14 about apples and oranges. We're talking about -- we are talking about apples 

15 and oranges. We're not having a direct connection between the languages 

16 used as would be understand ordinary skill in the art. 

17 I realize that our time is up, but we really would like to touch on this 

1 8 last point with regard to the second set of independent claims. 

19 JUDGE MARTIN: Sure, go ahead. 

20 MR. ALL Right, just real quick. You know, what we're referring to 

21 here in terms of the, the specific value that's being determined here, you 

22 know, it's not just - it's not simply just a value in a range of values, but it 

23 specifically relates to a service, again as we were talking about before, and 

24 provides a performance index of that grade of service. Now what the 

25 Examiner is relying on as allegedly being this value is I believe Roytman 
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1 which simply -- is simply just an alarm display system, and what's being -- 

2 what he's referring to is figure 6 and 7 there where one of the pieces of 

3 information that is displayed together with an alarm is, you know, the 

4 severity of the critical major and minor determinates, something like that, 

5 and you know, while that -- you could say that that is a value in a range of 

6 values, perhaps those different possible severities are a range of values, that 

7 doesn't provide any information relating -- that specifically relates to 

8 performance index with the grade of service. It provides, you know, a 

9 severity of an alarm. There's no correlation to service, service level or 

10 anything like that. So it's a different type of value and, you know, it doesn't 

1 1 seem like the Examiner has really fairly considered that context of the — 

12 that's recited in the claim. 



1 3 JUDGE BARRY: Okay, so it's a value but a different -- a value that 

14 represents something other than what yours represents? 

15 MR. TOERING: Yeah, exactly. The one is, the one is a value, a 

16 severity of an alarm or a severity of a, of a problem. 

17 JUDGE BARRY: Okay. 

18 MR. TOERING: Right, and the -- 1 mean, it's like saying -- 

19 JUDGE BARRY: The value — so your value and this value describe 

20 different things. 

21 MR. TOERING: Yeah, and, and it's expressly set forth in the claim. 

22 JUDGE BARRY: Right. 

23 JUDGE MARTIN: Now the, the claim is -- let me ask you this about 

24 the - how many resources do you have to be monitoring in claim 23? Just 

25 one or more, right? Could be one resource. We could be monitoring one 
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1 parameter. There's also another "one or more" -- oh, the network could be 

2 capable of performing a single function. Seems like this claim is - possibly 

3 you could read this on just monitoring one thing, I don't know, say in 

4 Maccabee a printer. I forget exactly what he talks about monitoring, but 

5 could you read this claim on monitoring a single component generating a 

6 single alarm? 



7 MR. ALL Yes, but -- 

8 JUDGE MARTIN: I'm sorry, they don't even have alarms here. I'm 

9 sorry. Monitoring a single component - 

10 MR. TOERING: Which claim? I'm sorry - 

11 MR. ALL Twenty-three. 

12 JUDGE MARTIN: Claim 23. It, it seems very broad, and it doesn't 



1 3 require that we have - that the service have - be doing more than one 

14 particular function. It seems like the service could be just one function 

15 operating on one resource, and if so, then the performance rating of that 

16 resource as indicated by the - those levels would, would also represent the 

17 performance index of the service. 



18 MR. ALL Right, if I could just stop - I mean, you said the 

19 performance rating of that resource, and again I would just emphasize that 

20 the claim language does not recite performance index of the resources - 

21 JUDGE MARTIN: Yeah, yeah, I misspoke. 

22 MR. ALL - but it's the service. 

23 JUDGE MARTIN: Yeah, let me, let me - 

24 MR. ALL So again, there's an abstraction over the, over the 

25 resources. 
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1 JUDGE MARTIN: No, let me back up. I, I realize I, I misspoke 

2 there. The severity rating of the single resource could, could — would also 

3 represent the performance index of the whole service if the service is only 

4 performing one function. In other words, the claim seems broad enough. It 

5 doesn't require plurality of resources operating or, you know, it's not 

6 requiring that you have a performance index that represents like an average 

7 of a lot of things going on. 



8 MR. ALL Okay. I mean, taking the example in Roytman which 

9 you're referring to, essentially what is being displayed here in terms of 

10 severity is the severity of the alarms. 

11 JUDGE MARTIN: Right. 

12 MR. ALL As we were talking about before or, or events, whatever — 

13 however they refer to it. 

14 JUDGE MARTIN: Yeah. 

15 MR. ALL Essentially what is - so you know, if you're going to try to 

16 map that to what's in our claim language, that would probably be best 

17 considered analogous to monitoring one or more parameters from collected 

18 data, so all this data that's been collected on the network, those alarms relate 

19 to essentially parameters on those, on those resources. 

20 JUDGE MARTIN: Okay, let's say for - 

21 MR. ALL So what, so what the, the value is in the subsequent 

22 determining step is not relating to those parameters but to the index of the 

23 grade of service. So it's, it's providing, you know, a measure of something 

24 different besides those, those alarms or those parameters. It's relating it to 

25 something different. 
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1 JUDGE MARTIN: Okay, any more questions? 

2 (No response) 

3 JUDGE MARTIN: All right, thank you, counsel. 

4 (Whereupon, the hearing concluded on January 22, 2009.) 
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